A security scanner analyzes software or systems for known vulnerabilities, unsafe configurations, and other security weaknesses. In AI-assisted development, scanning provides an additional check because generated code still requires careful human review. section 11.9.1
Use security scanning as part of a broader review process:
- Scan AI-generated code, especially components handling authentication, data access, or user input. section 11.9.1
- Pair scanning with fuzz testing and established security standards rather than treating either the tool or the generated code as automatically reliable. section 11.9.1
- Apply the same review process to human-written code, since experience and expertise do not eliminate vulnerabilities. section 11.9.1
Before accepting generated authentication code
Run a security scanner on the AI-generated authentication component, review the findings, and continue with human security checks and fuzz testing before relying on the change. section 11.9.1
